3 ms·
the malicious process had tor as a parent process/uid. Which makes me say it was definately the tor server that had some rce.
by DarkmSparks 4y ago
the malicious process had tor as a parent process/uid. Which makes me say it was definately the tor server that had some rce.
- Run_DOS_Run 4y agoIt is really hard to believe that a malicious actor is throwing expensive tor 0-days at random onions.. or your website to "discuss geopolitics with friends" was a bit greater. In both cases you could run a honeypot to catch 0-days.
- DarkmSparks 4y agothe webserver was a simple nanohttp hackup on the oracle jvm, so Ill take some convincing java has an rce in its network stack, and they disguised it by spawning a process on the tor user after hacking the OS and covering that up sufficiently to leave no other evidence. The only reason I spotted it was because I was checking for compromise by comparing any file/process changes every few weeks. It was a few years ago, my guess back then was tor is the honeypot, given what happened recently with encrochat I wouldnt be surprised if a few years down the line it turns out it was. Or maybe I misconfigured the server, or maybe the binary I used for tor was compromised, it was as much a test for whether I could trust tor as anything else and it failed. delete, move on.